Improper input validation in Gehealthcare Apexpro Telemetry Server
CVE-2020-6963
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code.
EPSS: 0.027 (84.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Gehealthcare Apexpro_telemetry_server
- Gehealthcare Apexpro_telemetry_server_firmware
- Gehealthcare Carescape_central_station_mai700
- Gehealthcare Carescape_central_station_mai700_firmware — versions 1.0
- Gehealthcare Carescape_central_station_mas700
- Gehealthcare Carescape_central_station_mas700_firmware — versions 1.0
- Gehealthcare Carescape_telemetry_server_mp100r
- Gehealthcare Carescape_telemetry_server_mp100r_firmware
- Gehealthcare Clinical_information_center_mp100d
- Gehealthcare Clinical_information_center_mp100d_firmware — versions 4.0, 5.0
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
- nvd@nist.gov (Product)
Frequently asked questions
- What is CVE-2020-6963?
- CVE-2020-6963 is a critical-severity vulnerability in Gehealthcare Apexpro Telemetry Server, classified under Use of Hard-coded Credentials. CVSS score: 10.0/10. Published 2020-01-24.
- How severe is CVE-2020-6963?
- Critical severity. CVSS v3 base score is 10.0 out of 10.